fedora-intune: enforce Defender protection settings

Defender's defaults left behavior monitoring off and every setting
unmanaged. Ship /etc/opt/microsoft/mdatp/managed/mdatp_managed.json:
real-time protection, behavior monitoring, PUA blocking, cloud-delivered
protection at the high block level, automatic definition updates and
sample submission, and scheduled scans (daily quick at 12:00, weekly full
on Wednesday 12:30, low priority). Users can't change managed settings.
The build fails if the file isn't valid JSON.

Network protection (Insiders channels only) and tamper protection
(audit-only preview on Linux) are left out.

The compliance script and rules now also check behavior monitoring and
cloud-delivered protection.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/intune/defender-compliance.json

@@ -84,6 +84,34 @@
         }
       ]
     },
+    {
+      "SettingName": "DefenderBehaviorMonitoring",
+      "Operator": "IsEquals",
+      "DataType": "Boolean",
+      "Operand": true,
+      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
+      "RemediationStrings": [
+        {
+          "Language": "en_US",
+          "Title": "Behavior monitoring is off.",
+          "Description": "Microsoft Defender behavior monitoring must be enabled. Update the device to the latest image or contact IT."
+        }
+      ]
+    },
+    {
+      "SettingName": "DefenderCloudProtection",
+      "Operator": "IsEquals",
+      "DataType": "Boolean",
+      "Operand": true,
+      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
+      "RemediationStrings": [
+        {
+          "Language": "en_US",
+          "Title": "Cloud-delivered protection is off.",
+          "Description": "Microsoft Defender cloud-delivered protection must be enabled. Update the device to the latest image or contact IT."
+        }
+      ]
+    },
     {
       "SettingName": "DefenderDefinitionsUpToDate",
       "Operator": "IsEquals",

images/fedora-intune/intune/defender-compliance.sh

@@ -28,6 +28,8 @@ healthy=false
 licensed=false
 onboarded=false
 rtp=false
+behavior_monitoring=false
+cloud_protection=false
 definitions_ok=false
 definitions_age=-1
 version=""
@@ -40,6 +42,8 @@ if [[ -x "${MDATP}" ]]; then
     healthy="$(bool "$(field healthy)")"
     licensed="$(bool "$(field licensed)")"
     rtp="$(bool "$(field real_time_protection_enabled)")"
+    [[ "$(field behavior_monitoring)" == enabled ]] && behavior_monitoring=true
+    cloud_protection="$(bool "$(field cloud_enabled)")"
     [[ -n "$(field org_id)" ]] && onboarded=true
     [[ "$(field definitions_status)" == up_to_date ]] && definitions_ok=true
     age="$(field definitions_updated_minutes_ago)"
@@ -57,6 +61,8 @@ cat <<EOF
   "DefenderLicensed": ${licensed},
   "DefenderOnboarded": ${onboarded},
   "DefenderRealTimeProtection": ${rtp},
+  "DefenderBehaviorMonitoring": ${behavior_monitoring},
+  "DefenderCloudProtection": ${cloud_protection},
   "DefenderDefinitionsUpToDate": ${definitions_ok},
   "DefenderDefinitionsAgeDays": ${definitions_age},
   "DefenderVersion": "${version}"